Data Gathering – Within one week of the attack, information from the investigation started to become public. We soon knew there were 19 hijackers, which planes they were on, and which nation’s passports they had used to get into America. As more information about the hijackers’ past was uncovered the investigators decided to map links of three strengths (and corresponding thickness). The tie strength would largely be governed by the amount of time together by a pair of terrorists. Those living together or attending the same school or the same classes/training would have the strongest ties.

Those traveling together and participating in meetings together would have ties of moderate strength and medium thickness. Finally, those who were recorded as having a single transaction together, or an occasional meeting, and no other ties, they classified as weak ties that were shown with the thinnest links in the network.

The investigators started their mapping project upon seeing several summaries of data about the hijackers in major newspapers (Sydney Morning Herald, 2001; Washington Post, 2001). These data collections contained information about the nodes/hijackers and their links/relationships.

From two to six weeks after the event, it appeared that a new relationship or node was added to the network on a daily basis. Several false stories appeared about a cell in Detroit. These stories, originally reported with great fanfare, were proven false within one week. This made the investigators very cautious about adding a link or a node to the network.

The network was created iteratively as data became available. Everyday the investigators checked the major news sources for updated information. Figure “1” shows their computer screen during this process. The browser window shows the news story, the other window shows the network mapping and measuring software. They would add nodes and links to the map as they read the news accounts. Figure “1” shows a link being added between one of the hijackers and an accomplice.

Figure 1

By the middle of October enough data was available to start seeing patterns in the hijacker network. Initially, the investigators examined the prior trusted contacts – those ties formed long ago through living and learning together. The network self-organized (via a network layout algorithm) into the shape of a serpent – how appropriate, they thought.

Figure 2

The investigators were amazed at how sparse the network was and how distant many of the hijackers on the same team were from each other. Many pairs of team members were beyond the horizon of observability from each other – many on the same flight were more than two steps away from each other. A strategy for keeping cell members distant from each other, and from other cells, minimizes damage to the network if a cell member is captured or otherwise compromised. Usama bin Laden even described this plan in his infamous videotape, which was found in Afghanistan. In the transcript (U.S. Department of Defense, 2001) Usama bin Laden mentions: “Those who were trained to fly didn’t know the others. One group of people did not know the other group.”

The network metrics for the network in Figure “2” are found in Table “1”. For a small network of less than 20 nodes, we see a long average path length of 4.75 steps. Several of the hijackers are separated by more than 6 steps. From this metric and bin Laden’s comments above we see that covert networks trade efficiency for secrecy.

Table 1: Small-World Network Metrics

Clustering Coefficient

Average Path Length

Contacts

0.41

4.75

Contacts + Shortcuts

0.42

2.79

Yet, work has to be done, plans have to be executed. How does a covert network accomplish its goals? Through the judicious use of transitory shortcuts in the network. Meetings were held that connected distant parts of the network to coordinate tasks and report progress. After coordination was accomplished, the cross-ties went dormant. One well documented meeting of the hijacker network took place in Las Vegas. The ties from this and other meetings are shown in gold in Figure “3”.

Figure 3

Six (6) shortcuts were added to the network temporarily in order to collaborate and coordinate. These shortcuts reduced the average path length in the network by over 40% thus improving the information flow in the network – see Table “1”. When the network is brought closer together by these shortcuts, all of the pilots ended up in a small clique – the perfect structure to efficiently coordinate tasks and activities. There is a constant dynamic between keeping the network hidden and actively using it to accomplish objectives.

The 19 hijackers did not work alone. They had other accomplices that did not get on the planes. These co-conspirators were conduits for money and also provided needed skills and knowledge. Figure “4” shows the hijackers and their network neighborhood – their direct and indirect associates.

Figure “4”

After one month of investigation it was ‘common knowledge’ that Mohamed Atta was the ring leader of this conspiracy. Again, bin Laden verified Atta’s leadership role in the video tape (U.S. Department of Defense, 2001). Looking at the diagram he has the most connections. In Table “2” we see that Atta scores the highest on all network centrality metrics – Degrees, Closeness, and Betweenness.

The network metric Degrees reveals Atta’s activity in the network. Closeness measures his ability to access others in the network and monitor what is happening. Betweenness shows his control over the flow in the network – he plays the role of a broker in the network. These metrics support his leader status.

Table 2: Hijackers Network Neighborhood

Degrees* possible false ID

Betweenness

Closeness

0.361

Mohamed Atta

0.588

Mohamed Atta

0.587

Mohamed Atta

0.295

Marwan Al-Shehhi

0.252

Essid Sami Ben Khemais

0.466

Marwan Al-Shehhi

0.213

Hani Hanjour

0.232

Zacarias Moussaoui

0.445

Hani Hanjour

0.180

Essid Sami Ben Khemais

0.154

Nawaf Alhazmi

0.442

Nawaf Alhazmi

0.180

Nawaf Alhazmi

0.126

Hani Hanjour

0.436

Ramzi Bin al-Shibh

0.164

Ramzi Bin al-Shibh

0.105

Djamal Beghal

0.436

Zacarias Moussaoui

0.164

Ziad Jarrah

0.088

Marwan Al-Shehhi

0.433

Essid Sami Ben Khemais

0.148

Abdul Aziz Al-Omari*

0.050

Satam Suqami

0.424

Abdul Aziz Al-Omari*

0.131

Djamal Beghal

0.048

Ramzi Bin al-Shibh

0.424

Ziad Jarrah

0.131

Fayez Ahmed

0.043

Abu Qatada

0.409

Imad Eddin Barakat Yarkas

0.131

Salem Alhazmi*

0.034

Tarek Maaroufi

0.409

Satam Suqami

0.131

Satam Suqami

0.033

Mamoun Darkazanli

0.407

Fayez Ahmed

0.131

Zacarias Moussaoui

0.029

Imad Eddin Barakat Yarkas

0.404

Lotfi Raissi

0.115

Hamza Alghamdi

0.026

Fayez Ahmed

0.401

Wail Alshehri

0.115

Said Bahaji

0.023

Abdul Aziz Al-Omari*

0.399

Ahmed Al Haznawi

0.098

Khalid Al-Mihdhar

0.022

Hamza Alghamdi

0.399

Said Bahaji

0.098

Saeed Alghamdi*

0.017

Ziad Jarrah

0.391

Agus Budiman

0.098

Tarek Maaroufi

0.015

Ahmed Al Haznawi

0.391

Zakariya Essabar

0.098

Wail Alshehri

0.013

Salem Alhazmi*

0.389

Mamoun Darkazanli

0.098

Wail Alshehri

0.013

Salem Alhazmi*

0.389

Mamoun Darkazanli

0.098

Waleed Alshehri

0.012

Lotfi Raissi

0.389

Mounir El Motassadeq

0.082

Abu Qatada

0.012

Saeed Alghamdi*

0.389

Mustafa Ahmed al-Hisawi

0.082

Agus Budiman

0.011

Agus Budiman

0.372

Abdelghani Mzoudi

0.082

Ahmed Alghamdi

0.007

Ahmed Alghamdi

0.372

Ahmed Khalil Al-Ani

0.082

Lotfi Raissi

0.007

Ahmed Ressam

0.365

Salem Alhazmi*

0.082

Zakariya Essabar

0.007

Haydar Abu Doha

0.361

Hamza Alghamdi

0.066

Ahmed Al Haznawi

0.006

Kamel Daoudi

0.343

Abu Qatada

0.066

Imad Eddin Barakat Yarkas

0.006

Khalid Al-Mihdhar

0.343

Tarek Maaroufi

0.066

Jerome Courtaillier

0.004

Mohamed Bensakhria

0.339

Ahmed Alghamdi

0.066

Kamel Daoudi

0.003

Nabil al-Marabh

0.335

Waleed Alshehri

0.066

Majed Moqed

0.002

Jerome Courtaillier

0.332

Djamal Beghal

0.066

Mamoun Darkazanli

0.002

Mustafa Ahmed al-Hisawi

0.332

Khalid Al-Mihdhar

0.066

Mohamed Bensakhria

0.002

Said Bahaji

0.332

Saeed Alghamdi*

0.066

Mounir El Motassadeq

0.002

Wail Alshehri

0.328

Majed Moqed

0.066

Mustafa Ahmed al-Hisawi

0.001

Abu Walid

0.324

Ahmed Ressam

0.066

Nabil al-Marabh

0.001

Mehdi Khammoun

0.323

Ahmed Alnami

0.066

Rayed Mohammed Abdullah

0.001

Mohand Alshehri*

0.323

Nabil al-Marabh

0.049

Abdussattar Shaikh

0.001

Raed Hijazi

0.321

Haydar Abu Doha

0.049

Abu Walid

0.001

Rayed Mohammed Abdullah

0.319

Mohamed Bensakhria

0.049

Ahmed Alnami

0.001

Waleed Alshehri

0.316

Essoussi Laaroussi

0.049

Haydar Abu Doha

0.000

Abdelghani Mzoudi

0.316

Jerome Courtaillier

0.049

Mehdi Khammoun

0.000

Abdussattar Shaikh

0.316

Kamel Daoudi

0.049

Osama Awadallah

0.000

Abu Zubeida

0.316

Seifallah ben Hassine

0.049

Raed Hijazi

0.000

Ahmed Alnami

0.314

Rayed Mohammed Abdullah

0.033

Ahmed Ressam

0.000

Ahmed Khalil Al-Ani

0.313

Raed Hijazi

0.033

Bandar Alhazmi

0.000

Bandar Alhazmi

0.311

Abdussattar Shaikh

0.033

David Courtaillier

0.000

David Courtaillier

0.311

Bandar Alhazmi

0.033

Essoussi Laaroussi

0.000

Essoussi Laaroussi

0.311

Faisal Al Salmi

0.033

Faisal Al Salmi

0.000

Faisal Al Salmi

0.311

Mohand Alshehri*

0.033

Lased Ben Heni

0.000

Faisal Al Salmi

0.311

Osama Awadallah

0.033

Mohammed Belfas

0.000

Jean-Marc Grandvisir

0.308

Mehdi Khammoun

0.033

Mohand Alshehri*

0.000

Lased Ben Heni

0.308

Mohamed Abdi

0.033

Seifallah ben Hassine

0.000

Madjid Sahoune

0.307

David Courtaillier

0.016

Abdelghani Mzoudi

0.000

Majed Moqed

0.307

Mohammed Belfas

0.016

Abu Zubeida

0.000

Mamduh Mahmud Salim

0.305

Lased Ben Heni

0.016

Ahmed Khalil Al-Ani

0.000

Mohamed Abdi

0.303

Fahid al Shakri

0.016

Fahid al Shakri

0.000

Mohammed Belfas

0.303

Madjid Sahoune

0.016

Jean-Marc Grandvisir

0.000

Mounir El Motassadeq

0.303

Samir Kishk

0.016

Madjid Sahoune

0.000

Nizar Trabelsi

0.281

Mamduh Mahmud Salim

0.016

Mamduh Mahmud Salim

0.000

Osama Awadallah

0.264

Abu Walid

0.016

Mohamed Abdi

0.000

Samir Kishk

0.250

Abu Zubeida

0.016

Nizar Trabelsi

0.000

Seifallah ben Hassine

0.250

Jean-Marc Grandvisir

0.016

Samir Kishk

0.000

Zakariya Essabar

0.250

Nizar Trabelsi

0.081

Average

0.032

Average

0.052

Average

0.289

Centralization

0.565

Centralization

0.482

Centralization

Yet, we are obviously missing nodes and ties in this network. Centrality measures are very sensitive to minor changes in network connectivity. A discovery of a new conspirator or two, or the uncovering of new ties amongst existing nodes can alter who comes out on top in the centrality measures. We must be wary of incomplete data.

Conclusion

To draw an accurate picture of a covert network, we need to identify task and trust ties between the conspirators. The same four relationships we often map in many business organizations would tell us much about illegal organizations. This data is occasionally difficult to unearth with cooperating clients. With covert criminals, the task is enormous, and may be impossible to complete. Table “3” below lists multiple project networks and possible data sources about covert collaborators.

Table 3: Networks to Map

Relationship/Network

Data Sources

1. Trust

Prior contacts in family, neighborhood, school, military, club or organization. Public and court records. Data may only be available in suspect’s native country.

Of course, the common network researcher will not have access to many of these sources. The researcher’s best sources may be public court proceedings, which contain much of this data (U.S. Department of Justice, 2001).

The best solution for network disruption may be to discover possible suspects and then, via snowball sampling, map their individual personal networks – see whom else they lead to, and where they overlap. To find these suspects it appears that the best method is for diverse intelligence agencies to aggregate their individual information into a larger emergent map. By sharing information and knowledge, a more complete picture of possible danger can be drawn. In our data search we came across many news accounts where one agency, or country, had data that another would have found very useful.

To win this fight against terrorism it appears that the good guys have to build a better information and knowledge sharing network than the bad guys.